63
The device manages both local asymmetric key pairs and peer public keys for data encryption,
decryption, and digital signature.
Managing local key pairs
Generating local key pairs
You can generate RSA, DSA, or ECDSA key pairs on the device.
Distributing the public key of a local key pair
You can distribute the public key of a local key pair to a peer device by using one of the following
methods:
•
Display the public key, record the key, and then import the key to the peer device through
copy-and-paste.
•
Export the public key in a specific format to a file, and then import the public key file to the peer
device.
•
Display the public key in a specific format, save it to a file, and import the public key file to the
peer device.
Destroying a local key pair
To avoid key compromise, destroy the local key pair and generate a new pair after any of the
following conditions occurs:
•
An intrusion event has occurred.
•
The storage media of the device is replaced.
•
The local certificate has expired.
Managing peer public keys
To encrypt information sent to a peer device or authenticate the digital signature of the peer device,
you must configure the peer device's public key on the local device.
You can import, view, and delete peer public keys on the local device.
describes the peer public key configuration methods.
Table 17 Peer public key configuration methods
Method Prerequisites Remarks
Import the peer public key
from a public key file
(recommended)
1.
Save the host public key in a file
on the peer device.
2.
Get the file from the peer
device, for example, by using
FTP or TFTP in binary mode.
The system automatically converts
the imported public key to a string in
the Public Key Cryptography
Standards (PKCS) format.
Manually enter (type or copy)
the peer public key
Display and record the public key on
the peer device.
•
Be sure to enter the key in the
format in which the key is
displayed on the peer device. If
the key is not in the correct
format, the system discards the
key.
•
Always use the first method if
you are not sure of the format of
the recorded public key.
